CVE-2026-77753: Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Temporary Login Without Password (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.9.9
Event History
Frequently Asked Questions
Who can retain access after a temporary login is revoked or expires?
A recipient of a temporary login can retain access if they created an Application Password before the temporary access expired or was disabled. That retained access has the same role assigned to the temporary user, which is commonly Administrator in this plugin's main use case.
What interfaces remain accessible using the retained credential?
The retained Application Password can continue to provide access through the WordPress REST API and XML-RPC after the administrator believes the temporary login has been withdrawn.
What should be checked when investigating possible exposure?
Review whether temporary-login recipients created Application Passwords and whether any such passwords remain active after the associated temporary access was expired or disabled. Prioritize accounts that were granted elevated roles, especially Administrator.